1. Field of the Invention
The present invention relates to a method for updating security information, and to a client, a server and a management computer for use in the method.
2. Description of the Related Art
As shown in FIG. 7, a client that is connected to a server through a network comprises a CPU, a memory, a network interface, and a storage (local disk device) constituted by a hard disk device. An OS (Operating System), security software, and an application program are deployed in the memory. Various files are stored in the storage. These various files are a file group making up the OS, a policy file group, and a group of other files. The group of other files includes security software, an application program, data files (referred to simply as files as appropriate), and a file system. Various file management information, such as respective file attributes and a file allocation table, are described in the file system (e.g., see Yasuharu Murase, Nyumon MS-DOS kaitei shinpan (“Introduction to MS-DOS, Newly Revised Edition”), ASCII Corporation, Aug. 11, 1991, pp. 63–64).
As shown in FIG. 8, under the typical OS control, when the application program requests access to a file (S10), the file system is referenced by a file access control function, and it is determined whether or not access is to be permitted (S20). When access is permitted by this determination, the application program can access the file by a drive (S30->S40). The file that the application program accesses also includes files of the server connected through the network. That is, files of the server connected through the network are accessed by a network drive and a network card (S50->S60->S70).
Examples of the content of the file system stored in the storage include file attributes (see FIG. 2; e.g., see Yasuharu Murase, Nyumon MS-DOS kaitei shinpan (“Introduction to MS-DOS, Newly Revised Edition”), ASCII Corporation, Aug. 11, 1991, pp. 131–132), an allocation table (see FIG. 3), and a cluster (see FIG. 4). As shown in the file attributes of FIG. 2, attributes such as file names, path names, owners, and group names are made to correspond to each file. Particularly in relation to access to the respective files by users, such as the owners, groups, and the outside, respective headings of read (“read” in FIG. 2), write (“write” in FIG. 2), and implementation are disposed. Attributes relating to access columns of permitted (“permitted” in FIG. 2) and not permitted (“not permitted” in FIG. 2) are made to correspond to each of these headings.
The security software shown in FIG. 7 is software that is added to the OS and strengthens the access control function. The security software provides precise access control to further raise security on the basis of access control information described in the policy file. Detailed attributes, such as users, applications, and periods of time, are specified in the policy file as conditions permitting access to files.
A virus pattern file and a signature file are included in the policy file. The virus pattern file is used in virus countermeasure software called anti-virus software. The signature file is used in network attack countermeasure software called a host intrusion detection system. The anti-virus software inspects files, periodically or while a file is open, for the presence of computer virus infections on the basis of a pattern indicative of the characteristics of a computer virus, and appropriately takes necessary action. The host intrusion detection system identifies a network packet called a signature, detects attacks through the network, monitors e.g., a log file that the implemented application program outputs, and detects attacks.
The policy (security policy) referred to herein is security information generically naming limitations relating to use of a computer. In other words, the policy includes not only information for prohibiting the implementation of specific applications and preventing changes to settings, but also various kinds of software.
Next, the updating of the policy file in the network environment will be described. As shown in FIG. 9, first, when power is turned on and the client starts up (S100), the OS thereof is activated (S110). Services resulting from a network connection and various pieces of software are started up (S120) by a control of the activated OS, whereby the transmission and reception of data via the network become possible. The updating function of the policy file is started up by the implementation of the security software (S130), and the client receives updates of the policy file from a management computer through the network. That is, the client receives the latest version of the policy file from the management computer (S140). Thus, the client is allowed to implement various processing corresponding to operational inputs by a user (S150).
In the above conventional technology, the policy file is stored in a storage equipped with the client. Thus, the policy file naturally cannot be updated while the operation of the client is stopped. For this reason, access control, virus countermeasures, etc., cannot be conducted in the latest state during the period of time until the policy file is updated.
As shown in the flow chart of FIG. 9, because the policy file of the client is updated after start-up, the client is operated with the old version of the security information during the period of time from start-up until the security information is updated. In particular, network-infecting viruses attack devices connected to the network. Thus, the client is ordinarily in a state in which it is vulnerable to attack during the period of time from start-up until the security information is updated.
Moreover, in relation to updating of the policy, updating of the policy must be implemented with regard to each of a plurality of clients, and the entire management burden of each client becomes enormous.